UPDATE 1/26/2015 -- It appears the most recent JRE/JDK for Java 8 (update >= 31) and JRE/JDK for Java 7 now include the Godaddy G2 CA server in the default trust store. If possible, it's urged you upgrade your JRE/JDK to the latest Java 8 update to resolve this issue.

UPDATE 11/29/2014 -- This is still a problem, and Godaddy appears to not care nor will do anything about it. There is a blog post here by Godaddy VP of Security Products from several months ago saying a fix was on it's way and provided a temporary work-around, but as-of today nothing has changed. It is important to note that Godaddy's G2 CA server has been around for a minimum of 5 years, and in that time Godaddy has not taken the proper steps to resolve this known issue. The work-around provided is just that, a work-around, not a solution. Users of 3rd party services have zero control over how the cert is installed on the server.

It seems users should avoid purchasing Godaddy SSL certs until they get serious about being a CA.

UPDATE 9/17/2014 -- This is still a problem, and Godaddy appears to not care nor will do anything about it. Come November when Google deprecates all SHA-1 certs, this will become a major issue. I highly recommend anyone who can contact Godaddy and point them here.

~

tl;dr; - final update with current solution/workaround at the bottom of this post (it is a GoDaddy problem and there is a workaround until they fix it)

I have a mail server that I'm attempting to send mail through from my Java app. I can sent on port 25 successfully so I know code works and all, but 25 is not encrypted session. I need to use TLS on port 587 which requires an SSL cert. I have a valid SSL Cert on the server that is signed by GoDaddy G2 CA and has been in place for a while now (no problems).

From my understanding of many SO links as well as normal google-fu, this is usually caused when Java doesn't trust the cert or CA -- as is common for a self-signed cert. I've used several of the online SSL Cert checkers to make sure the chain is valid, etc. All appears to be normal... but java will not use the cert automatically.

I am aware there is a class file somewhere from Sun that will download and setup the cert in the local keystore so java will trust it... but this is not only impractical for an app that will be deployed to multiple systems, but is just silly for a Godaddy signed cert.

What's going on? How can I make java use the valid cert on the server without having to make java accept all certs?

EDIT: I just looked in my windows Java Control Panel (default install of jdk 7) and sure enough, under Signer CA the Issued By: The Go Daddy Group, Inc. Go Daddy Class 2 Certification Authority is listed... so what gives? My cert is a Godaddy cert...

Which looks better than before. -- Java still throws the same exception about the cert path, etc. So it appears that the G2 cert chain is not, by default, trusted yet in java 7's default keystore.

FINAL UPDATE FOR COMPLETENESS @ 1/14/2014

Just as an update - This is indeed a GoDaddy problem (I've had lengthy support emails with them). They have 2 CA servers, one called Class 2 CA and the other called G2 CA. Their Class 2 CA signs all SHA-1 certificates, while the G2 CA signs all their SHA-2 certificates. This is where the problem lies - GoDaddy has not added their newer G2 CA server to the default java truststore - causing default java installations to not trust it's authority, and hence, does not trust your chained certificate. The work-around until GoDaddy adds the G2 CA server to the default truststore is to simply rekey your cert using SHA-1 as-to get a cert signed by the Class 2 CA server. Rekeying is free for GoDaddy customers until your cert expires (obviously).

Do you control the server? What is its certificate chain? You can see this with openssl -connect the.server.name:587 -starttls smtp.
– BrunoSep 11 '13 at 18:38

i do control the server, it's here in our office. its out public-facing email server (zimbra). it's signed by godaddy's G2 CA, which uses a chain (chain is installed on the server and the various ssl verification tools online say the chain is valid).
– SnakeDocSep 11 '13 at 19:04

Just as an update - This is indeed a GoDaddy problem. They have 2 CA servers, one called Class 2 CA and the other called G2 CA. Their Class 2 CA signs all SHA-1 certificates, while the G2 CA signs all their SHA-2 certificates. This is where the problem lies - GoDaddy has not added their newer G2 CA server to the default java truststore - causing default java installations to not trust it's authority, and hence, does not trust your chained certificate. The work-around until GoDaddy adds the G2 CA server to the default truststore is to simply rekey your cert using SHA-1.
– SnakeDocJan 14 '14 at 0:03

11 Answers
11

UPDATE 1/26/2015 -- It appears the most recent JRE/JDK for Java 8 (update >= 31) and JRE/JDK for Java 7 now include the Godaddy G2 CA server in the default trust store. If possible, it's urged you upgrade your JRE/JDK to the latest Java 8 update to resolve this issue.

UPDATE 11/29/2014 -- This is still a problem, and Godaddy appears to not care nor will do anything about it. There is a blog post[here][1]by Godaddy VP of Security Products from several months ago saying a fix was on it's way and provided a temporary work-around, but as-of today nothing has changed. It is important to note that Godaddy's G2 CA server has been around for a minimum of 5 years, and in that time Godaddy has not taken the proper steps to resolve this known issue. The work-around provided is just that, a work-around, not a solution. Users of 3rd party services have zero control over how the cert is installed on the server.

It seems users should avoid purchasing Godaddy SSL certs until they get serious about being a CA.

UPDATE 9/17/2014 -- This is still a problem, and Godaddy appears to not care nor will do anything about it. Come November when Google deprecates all SHA-1 certs, this will become a major issue. I highly recommend anyone who can contact Godaddy and point them here.

~~~~

My initial post/question was regarding why my chain was not working. It became obvious I had a bad setup (which was quickly fixed with some advice from @Bruno and others - thanks). However, when my corrected chain still did not work with Java, it became apparent there was a much bigger problem lurking. It took a while, but the problem is actually with GoDaddy.

This actually is indeed a GoDaddy problem (I've had lengthy support emails with them).

They have 2 CA servers, one called Class 2 CA and the other called G2 CA. Their Class 2 CA signs all SHA-1 certificates, while the G2 CA signs all their SHA-2 certificates.

This is where the problem lies - GoDaddy has not added their newer G2 CA server to the default Java truststore/keystore - causing default Java installations to not trust it's authority, and hence, does not trust your chained certificate.

The work-around until GoDaddy adds the G2 CA server to the default truststore/keystore is to simply rekey your cert using SHA-1 as-to get a cert signed by the Class 2 CA server. Rekeying is free for GoDaddy customers until your cert expires (obviously).

Once you have a SHA-1 cert signed by the Class 2 CA server, your trust chain should work as expected and no custom truststore/keystore imports and/or setup is required.

It does not make me happy that I must use a "weaker" cert in order to get it to work properly, and discussions with GoDaddy via email support thus far have indicated they have no current plans to add the G2 CA server to the default truststore/keystore. I guess until they do add it, make sure you get a SHA-1Class 2 CA server signed cert if you plan to work with Java.

This solution worked for me when our windows mobile 6.5 devices would not authenticate with our webservices. Thanks so much for the help
– Ben AndersonFeb 28 '14 at 20:37

Thanks for your research on this and for sharing. In the Java Control Panel, on the Advanced tab, there is an option for 'Use certificates and keys in browser keystore,' so it should not be checking the cert against the Java keystore (I would think). But when I use Google Chrome, I'm still having a problem...
– BaodadJul 31 '14 at 21:20

3

I just received an email from GoDaddy today stating that I should rekey my ssl certificate to SHA-2 so it will continue to work flawlessly with Chrome after November. However, in doing so, it will use the G2 CA instead of the Class 2 CA, which will cause it to fail with Java. What to do.. what to do?
– Brain2000Sep 16 '14 at 23:02

2

I saw the same message as @Brian2000. Full details by GoDaddy on Chrome phasing out SHA-1 is here: garage.godaddy.com/webpro/security/… We may be in trouble unless GoDaddy soon adds their G2 CA server the default Java truststore/keystore.
– Johnny OshikaSep 16 '14 at 23:16

Personally I think people need to hound on GoDaddy and link them to this page. If I'm the only person who's brought this to their attention, they will shrug it off like they have so far.
– SnakeDocSep 17 '14 at 15:17

Mr. Fixer and Wayne Thayer's answers have been downvoted, but they are actually advocating the correct work-arounds. In fact, Wayne Thayer leads GoDaddy's SSL business, so he probably knows. You should install the "GoDaddy G1 to G2 Cross" certificate in your certificate chain along with the intermediate certificate.

Downgrading to SHA1 is not an ideal option since it's being deprecated and will cause you more work in the future. Fortunately, GoDaddy has provided a crossover certificate that solves this problem. They posted instructions, which Wayne has duplicated, and they're buried in the comments here.

I have personally tested this solution with a SHA2 cert, and it works well. It's a far superior solution vs. re-keying and downgrading to SHA1. When SHA2 becomes required, this option won't be available anyway, and there might still be Java toolchains out there without the new certificate.

According to GoDaddy support, as of July 2014, the correct root certificate was included in recent versions of Java 8, and in September 2014, Wayne Thayer of GoDaddy also said that the certificate "is scheduled to be added to Java in the next few months". I have checked the cacerts file in Java 8 for Mac OS downloaded from here, and it does indeed contain the SHA2 root certificate.

"GoDaddy has also said that the certificate will be included in future Java releases." can you point to where that is said? This has been an open issue reported multiple times for well over a year (with many java releases in-between), and has been an issue for many years prior to it being reported (the G2 CA server's cert was signed in 2009, so it's been an issue for 5+ years so far). Also it's suspect when brand new and/or no-activity accounts post these work-arounds as answers.
– SnakeDocNov 28 '14 at 21:29

I see you updated your post, but still haven't answered the underlying issue. Godaddy apparently has no plans to fix this, and your proposed "solution" is not a solution, it is a work-around/hack. If you try to work with a service that uses a SHA-2 Godaddy SSL cert from Java, it won't trust it, and you won't have any control over it. The solution is for Godaddy to add their G2 CA server into the default Java truststore... something we've been waiting 5+ years for.
– SnakeDocNov 28 '14 at 22:11

5

I don't have a dog in this fight. I'm just trying to get the correct workaround out there. You may have a legitimate issue with GoDaddy, but please don't take it out on me or the people who come here looking for a workable solution. The top-voted solution of downgrading to SHA1 is insecure and is not forward-compatible with the SHA1 deprecation. I agree that the root CA needs to get into Java, but a server-side workaround is the only way to deal with Java versions that have already shipped without the cert. Please stop down-voting people who post the workaround that GoDaddy has published.
– Isaac Potoczny-JonesNov 29 '14 at 6:43

1

I did note the timeline and I recognize that this thread is older than GoDaddy's blog post on how to address it. Nevertheless someone has been downvoting the only viable solution for months. This behavior has wasted a huge amount of my time and my team's time.
– Isaac Potoczny-JonesNov 29 '14 at 21:15

To get Godaddy certificates to work in Java with SHA2 you will need to use their cross certificate in your chain to chain the G2(SHA2) root to the G1(SHA1) root until Java decides to update their repository. The Cross Certificate bundle can be downloaded here:

Are you saying that if the server serving the SSL SHA-2 GoDaddy cert installs this crossover root cert bundle, then Java will be able to connect to it without modifying the java lib/security/cacert chain?
– nvioliOct 2 '14 at 14:47

Supposedly you will not have to modify the java cert to get the cross certificate to work. However, I found that the SHA2 G2 certificate is now included in the default Java security store. I installed Java 8u31.
– Brain2000Jan 26 '15 at 22:49

Mr. Fixer is right. Install the "GoDaddy G1 to G2 Cross" certificate in your certificate bundle file along with the intermediate certificate. This allows GoDaddy SHA-2 certificates to be trusted by any client that recognizes the SHA-1 roots including Java. You can get this file from https://certs.godaddy.com/repository Once this is installed, Java will build a certificate chain from your certificate to the "GoDaddy Secure Server Certificate (Intermediate Certificate)" to the "GoDaddy G1 to G2 Cross Certificate" to the GoDaddy SHA-1 root. You can also find a bundle file containing the cross certificate in our repository. One last note on this option: The signatures on root certificates aren't checked so even though you're relying on a SHA-1 root, this is just as secure as a full SHA-2 certificate chain.

My guess is that the bundle already contained the g2 cert. One way or another, you really only need 2 certs here: cert 0 (your cert) and cert 1 (the intermediate G2). I'd check the content of the bundle files. You can feed each --BEGIN/END-- section into openssl x509 -text -noout to see what these certs are.
– BrunoSep 12 '13 at 18:12

1

I'm surprised you need to regenerate the CSR. I would try to reconfigure with the existing certs before going through the CA process again. It looks like there are some command-line tools if the wizard doesn't help: wiki.zimbra.com/wiki/… I don't really know Zimbra, but it looks Java-based. If you can find where its keystore is, you might be able to re-import the chain with keytool if you've found the right alias (same method as here).
– BrunoSep 12 '13 at 18:18

1

Just to make sure, have you tried to import that root CA into your security/cacerts file with keytool? (I'd make a copy of the original file first, also make sure it's the one used by your application, if you have both JDK and standalone JRE installed, for example).
– BrunoSep 13 '13 at 14:57

1

I was able to basically confirm the G2 CA is not default trusted by java yesterday - see this godaddy link: support.godaddy.com/groups/ssl-certificates/forum/topic/… -- godaddy has their "Class 2 CA" added to the default truststore, but not the "G2 CA". So the gist... it basically wont work by default unless I manually set the keystore to trust that CA on every deployed machine this program will run on... a PITA imho.
– SnakeDocSep 13 '13 at 15:43

It sounds like your mail server is not signed by Go Daddy Class 2 Certification Authority, but is actually signed by one of their intermediate certificate authorities. You will need to verify this for yourself. Assuming this is the case...

In theory, your software should work - since the intermediate certificate is signed by the class 2 authority and you have the class 2 authority in the default JDK certificate store. However, I have found that it just does not work unless you also add the intermediate certificate to your certificate store. Here is a link to a blog post describing a similar experience:

I cannot advise on exactly which certificate you must add - it depends on which CA is used in your mail server.

[update]

is there a way to do this programmically?

Maybe. Depends on what you want to do. I have used the java.security.KeyStore class to automatically update a private keystore directly from Java code without using keytool. It is conceptually simple - load the keystore from a file, read the new certificate, add it to the keystore and then write out the keystore to new file. However it takes a while to get the details right and it may not be worth the trouble just to import a single certificate.

Still, it is interesting to try. Checkout KeyStore JavaDoc and read up on the load, store and setCertificateEntry methods.

+1 as this seems to be the underlying culprit - it is signed by the intermediate authority, not the main Class 2 authority... rats! -- the link you posted on how to import the cert seems fine and all, but is there a way to do this programmically? I'd like to avoid having to ship the product with cert files and have some script install them... there's too many variables that could go wrong, such as installation system os, etc...
– SnakeDocSep 11 '13 at 17:34

Ok, I'm going to accept this as the answer, since it's more "proper" solution than my hacky-work-around below. My workaround basically ignores the keystore and says "trust this server's cert", at least from my understanding... making your solution more permanent and elegant.
– SnakeDocSep 11 '13 at 18:59

5

FYI, this has been filed as a JDK bug. Note also that GoDaddy has issued a cross certificate from the G2 to the G1 root (the one used by the mail server). You should be able to download the "Go Daddy G1 to G2 Cross Certificate" and configure the mail server certificate chain to include this certificate at the end of the chain. Then the JRE will be able to build a trusted chain from the G2 root in the cacerts file.
– Bill ShannonSep 16 '13 at 22:07

Update - this "solution" is no longer valid (see my above accepted answer) - keeping this answer because it did help alleviate the problem so long as the side-effects are tolerable.

Ok, I may have found a work-around for my case.

props.put("mail.smtp.ssl.trust", "smtp.somecompany.com");

I added this to my Session construction, and now it works. This is a work-around, not a fix imho since I still do not know why my Godaddy SSL cert is not default trusted... it is not a self-signed cert.

Anyone please feel free to chime in as I'd really like to understand this problem.

As far as I know, this disables the certificate verification for that particular host, which isn't a good idea.
– BrunoSep 11 '13 at 18:38

1

right, this is why i call this a work-around instead of a solution. in my particular case, it's a server here at our office, but would still be susceptible to a man-in-the-middle attack since it will always trust whatever cert the server responds with... even if it's changed or wrong.
– SnakeDocSep 11 '13 at 19:01